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DETAILED ACTION 

1. Amendment received on 04/30/2009 has been entered into record. Claims 1, 12 and 17 
are amended. Claims 1-20 are currently pending. 

2. Applicant's submission filed on 02/09/2009 was entered. The amendment to the 
specification to change the title of application was reviewed and accepted. Claims 1,12 and 17 
were amended. 

3. Amendment received on 08/20/2008 has been entered into record. Claims 1, 12-13 and 
17-20 are amended. 

Priority 

4. This application has claimed priority from provisional application 60528643 filed on 
12/10/2003. The filing date is 03/30/2004. 
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Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject matter 
sought to be patented and the prior art are such that the subject matter as a whole would have 
been obvious at the time the invention was made to a person having ordinary skill in the art 
to which said subject matter pertains. Patentability shall not be negatived by the manner in 
which the invention was made. 

Claims 1-9 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley et al. (US 
7277957 B2), hereinafter referred as Rowley and further in view of Saulpaugh et al. (US 
7072967 Bl), hereinafter referred as Saulpaugh. 

a. Rowley shows (claim 1) an apparatus (Fig. 1 and Fig. 2) comprising: a network 
interface module to connect the apparatus to a network (column 3, lines 28-33; 
Ethernet card as a network tap device); a packet capture module to intercept packets 
being transmitted on the network (column 3, lines 33-35: a packet capture engine); an 
object assembly module to reconstruct flows representing objects being transmitted 
on the network from the intercepted packets (column 4, lines 9-12: packets are 
sequentially read, decoded, checked and added to the protocol sorted list until the last 
packet has been retrieved; column 4, lines 29-34: data from the selected packets may 
be reconstructed into data files and script files used to display web pages and other 
content; column 6, lines 59-65: local cache holding word processing documents, PDF 
files, audio files and video files), the packets associated with a document (column 4, 
lines 29-34: packets reconstructed into data and script files for web pages and other 
contents), wherein objects are captured based on a capture rule that specifies the 
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objects, and wherein a determination is made as to whether to discard or to store the 
objects (column 3, lines 62-67: packet not needed for the subsequent reconstruction 
of the network communication session); an object classification module to determine 
a type of content of (column 4, lines 63-65: determine the type of packets; column 6, 
lines 6-11: packet indicates a script file type to be displayed as page, e.g. HTML, Java 
Script and Active Server Pages; multi-packet recompilation module set similar 
directories for local cache of files) and reconstruct objects from flows (column 4, 
lines 9-12: packets are sequentially read, decoded, checked and added to the protocol 
sorted list until the last packet has been retrieved; column 6, lines 59-65: local cache 
holding word processing documents, PDF files, audio files and video files); an object 
store module to store the objects (column 4, lines 9-12: packets are sequentially read, 
decoded, checked and added to the protocol sorted list until the last packet has been 
retrieved); and a user interface to enable a user to search objects stored in the object 
store module (column 7, line 66-column 8, line 1 : web browser or display program 
capable display text, graphic and other visual information on a computer monitor). 
Row le\ doe j not explk iti\ show (claim 1) the document includes the objects; 
wherein the objects are searched based a query, which includes search criteria used to 
identify selected objects that match the search criteria. Rowley does show (claim 1 ) 
however using browser to search and identify objects based upon search criteria 
seems to be known to one skill in the art. 
b. Saulpaugh shows reconstructing objects from XML data stream (column 82, lines 28- 
52); search based on search criteria (column 33, line 55-column 34, line 3); database 
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query based upon name or strings (column 41, line 60-column 42, lines 10); query 
results cache (column 48, lines 33-52); and search tag may contain optional set of 
search criteria (column 64, line 10-column 65, line 9) <n or* ^olo^us :m the 
puqxw>. of efficient construction of message endpoints. 

im ention y> a } made to modify Rowley's functions of reconstructing network 
communications with Saulpaugh's functions of reconstructing objects from XML 
data stream and message query based on name or string. 

would have been motivated to data selection or query based on name or string as per 
Saulpaugh's teaching in support the display of data collected and reconstructed as per 
Rowley (column 1, lines 54-65) and Saulpaugh (column 82, lines 28-52)'s teaching. 

e. Regarding claim 2, Rowley shows wherein the object assembly module comprises a 
reassembler to assemble the intercepted packets into flows (column 4, lines 9-12: 
packets are sequentially read, decoded, checked and added to the protocol sorted list 
until the last packet has been retrieved; column 6, lines 59-65: local cache holding 
word processing documents, PDF files, audio files and video files). 

f. Regarding claim 3, Rowley shows wherein the object assembly module further 
comprises a protocol demultiplexer to sort the assembled flows by protocol (column 
4, lines 9-12: packets are sequentially read, decoded, checked and added to the 
protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
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local cache holding word processing documents, PDF files, audio files and video 
files). 

g. Regarding claim 4, Rowley shows wherein the object assembly module further 
comprises a protocol classifier to extract the objects from the sorted assembled flows 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

h. Regarding claim 5, Rowley shows wherein the object classification module 
determines whether objects are stored in the object store or discarded based on one or 
more capture rules (column 3, lines 62-67: packet not needed for the subsequent 
reconstruction of the network communication session). 

i. Regarding claim 6, Rowley shows wherein the capture rules are user-configurable 
through the user interface (column 1, line 66-column 2, line 9: selecting a portion of 
the packets captured by a sniffer during a giving time interval; column 3, lines 43-47: 
selecting captured data during a specified time interval). 

j. Regarding claim 7, Rowley shows wherein the object classification module 

determines a location that each object is stored in the object store based on the type of 
content of each object (column 6, lines 38-48: directory structure based on image file 
type; column 6, lines 49-65: directory structure for graphics files, text files, audio 
files and video files). 
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k. Regarding claim 8, Saulpaugh show - wherein the object classification module 

determines the type of content of each object using a signature of each object (column 
82, lines 28-52: an object signature may be included to identify the object's class). 
1. Regarding claim 9, Rowley shows wherein the user interface comprises a graphical 
user interface (column 7, line 66-column 8, line 1 : web browser or display program 
capable display text, graphic and other visual information on a computer monitor). 
Together Rowley and Saulpaugh disclosed all limitations of claims 1-9. Claims 1-9 are 
rejected under 35 U.S.C. 103(a). 
6. Claims 10-11 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley, 
Saulpaugh and further in view of Barnctt ct al. (US 7290048 Bl ), hereinafter referred as Barnett. 

a. Rowley shows claim 1 as above. Neither Row ley nor Saulpaugh shows (claim 10) 
wherein the object store module comprises a content store to store the objects and a 
tag store to Index the objects stored in the object store. How ever, Rowley doe< show 
identifying protocol and collecting packets into a protocol sorted list; selecting, 
reconstructing and displaying data information, e.g. web pages, from a protocol 
session. 

b. Barnett shows (claim 10) wherein the object store module comprises a content store 
to store the objects and a tag store to index the objects stored in the object store 
(column 10, lines 52-61 : tags and other columns support transaction recognition, 
pointer to original sources of data for traceability; column 22, lines 18-37: tags 
interpreted are time, data, file name, line numbers, graph object types, source, 
destination and tool tip information) . s i tbi ie pni osc of data 
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collection, data analysis, and model generation for the performance analysis of 
enterprise applications. 

c. t would have been obvious t( 

invention was made to modify Rowley's functions of reconstructing network 
communications with Saulpaugh's functions of message query based on name or 
string and Barnett's functions of using tags in support of performance analysis. 

d. The modification would have been obvious because one of ordain, si n\ in tk %t s 
s\ ouM ks\ . iv js nvi *\ ,!?vM to tag and identify data as per Barnett's teaching in 
support the data collection and reconstruct as per Rowley (column 1 , lines 54-65), 
Saulpaugh (column 82, lines 28-52) and Barnett (column 7, lines 35-45)'s teaching. 

e. Regarding claim 11, Barnett shows wherein the content store comprises a canonical 
storage, and the tag store comprises a database (column 12, lines 4-12: canonical 
form for abstract module, sources supply lines information form text file, binary file 
or database; column 13, lines 26-48: data consists of network traces consisting of 
arrays mutated into hash tables to be addresses by column header vs. row and column 
locations). 

Together Rowley, Saulpaugh and Barnett disclosed all limitations of claims 10-11. Claims 
10-11 are rejected under 35 U.S.C. 103(a). 
7. Claims 12-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley in 
view of Saulpaugh and Barnett. 

a. Rowley shows (claim 12) an method comprising: intercepting data being transmitted 
on a network (column 3, lines 33-35: a packet capture engine); reconstructing flows 
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of objects being transmitted on the network from the intercepted data (column 4, lines 
9-12: packets are sequentially read, decoded, checked and added to the protocol 
sorted list until the last packet has been retrieved; column 4, lines 29-34: data from 
the selected packets may be reconstructed into data files and script files used to 
display web pages and other content; column 6, lines 59-65: local cache holding word 
processing documents, PDF files, audio files and video files); classifying the 
reconstructed objects by content type (column 4, lines 63-65: determine the type of 
packets; column 6, lines 6-11: packet indicates a script file type to be displayed as 
page, e.g. HTML, Java Script and Active Server Pages) ), the data associated with a 
document (column 4, lines 29-34: packets reconstructed into data and script files for 
web pages and other contents), wherein objects are captured based on a capture rule 
that specifies the objects, and wherein a determination is made as to whether to 
discard or to store the objects (column 3, lines 62-67: packet not needed for the 
subsequent reconstruction of the network communication session; and storing the 
classified objects (column 4, lines 9-12: packets are sequentially read, decoded, 
checked and added to the protocol sorted list until the last packet has been retrieved). 
Rowley does not show (claim 12) the document includes the objects; creating a tag to 
describe each reconstructed object; storing tags; indexing the stored objects to enable 
searching of the stored objects via the tags; and wherein the objects are searched 
based on a query, which includes search criteria used to identify selected objects that 
match the search criteria. However. Rowley does show identifying protocol and 
collecting packets into a protocol sorted list as per IP address and port number to 
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categorize packets (column 4, lines 42-65); selecting, reconstructing and displaying 
data information, e.g. web pages, from a protocol session, including the directory and 
file structures (column 7, lines 37-51). 

b. Barnett shows (claim 12) creating a tag to describe each reconstructed object; storing 
tags; storing tags; indexing the stored objects to enable searching of the stored objects 
via the tags (column 10, lines 52-61 : tags and other columns support transaction 
recognition, pointer to original sources of data for traceability; column 22, lines 18- 
37: tags interpreted are time, data, file name, line numbers, graph object types, 
source, destination and tool tip information) * - a \; - v ^a- ass v> iho p'ar^v >•! 
data collection, data analysis, and model generation for the performance analysis of 
enterprise applications. 

c. Saulpaugh shows reconstructing objects from XML data stream (column 82, lines 28- 
52); search based on search criteria (column 33, line 55-column 34, line 3); database 
query based upon name or strings (column 41, line 60-column 42, lines 10); query 
results cache (column 48, lines 33-52); and search tag may contain optional set of 
search criteria (column 64, line 10-column 65, line 9) in an analogous art for the 
purpose of efficient construction of message endpoints. 

d. 1 1 w ouici ha v-e been ob\ iou- to a pei son of ordinary skill in the art at the time of the 

^ea n \ Rowley's functions of reconstructing network 

communications with Saulpaugh's functions of reconstructing objects from XML 
data stream and message query based on name or string and Barnett' s functions of 
using tags in support of performance analysis. 
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C. s \ v V 0 , 

w^uld ii t\ * boon nvi^ ^ - tag and identify data as per Barnett's teaching in 
support the data collection and reconstruct as per Rowley (column 1, lines 54-65), 
Saulpaugh (column 82, lines 28-52) and Barnett (column 7, lines 35-45)'s teaching. 

f. Regarding claim 13, Rowley shows wherein reconstructing the objects comprises: 
sorting the intercepted data into packets; and sorting the assembled flows by protocol 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

g. Regarding claim 14, Rowley shows further comprising determining whether each 
object is to be stored based on a set of one or more capture rules (column 3, lines 62- 
67: packet not needed for the subsequent reconstruction of the network 
communication session). 

h. Regarding claim 15, Saulpaugh she* s further comprising receiving a query over the 
stored objects (column 27, lines 10-29: query for a message response). 

i. Regarding claim 16, Saulpaugh show > further comprising searching the indexed 
objects, and retrieving objects matching the query (column 41, line 60-column 42, 
lines 10: database query based upon name or strings; column 48, lines 33-52: query 
results cache); 

j. Regarding claim 17, Rowley shows an machine-readable storage medium having 
stored thereon data representing instructions (Fig. 1 and Fig. 2) that, when executed 
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by a processor, cause the processor to perform operations comprising: intercepting 
data being transmitted on a network (column 3, lines 33-35: a packet capture engine); 
reconstructing objects being transmitted on the network from the intercepted data 
(column 4, lines 29-34: data from the selected packets may be reconstructed into data 
files and script files used to display web pages and other content); classifying the 
reconstructed objects by content type (column 4, lines 63-65: determine the type of 
packets; column 6, lines 6-11: packet indicates a script file type to be displayed as 
page, e.g. HTML, Java Script and Active Server Pages), the data associated with a 
document (column 4, lines 29-34: packets reconstructed into data and script files for 
web pages and other contents) identifying characteristic of the document (column 5, 
lines 28-37: indicates a file with characteristics), wherein objects are captured based 
on a capture rule that specifies the objects, and wherein a determination is made as to 
whether to discard or to store the objects (column 3, lines 62-67: packet not needed 
for the subsequent reconstruction of the network communication session); and storing 
the classified objects (column 4, lines 9-12: packets are sequentially read, decoded, 
checked and added to the protocol sorted list until the last packet has been retrieved). 
Barnett shows creating a tag to describe each reconstructed object; storing tags; 
storing tags; indexing the stored objects to enable searching of the stored objects via 
the tags (column 10, lines 52-61: tags and other columns support transaction 
recognition, pointer to original sources of data for traceability; column 22, lines 18- 
37: tags interpreted are time, data, file name, line numbers, graph object types, 
source, destination and tool tip information). Saulpaugh shows reconstructing objects 
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from XML data stream (column 82, lines 28-52); search based on search criteria 
(column 33, line 55-column 34, line 3); database query based upon name or strings 
(column 41, line 60-column 42, lines 10); query results cache (column 48, lines 33- 
52); and search tag may contain optional set of search criteria (column 64, line 10- 
column 65, line 9). Claim 17 is of substantially same scope as claim 12. Thus the 
reasoning and motivation to combine of Rowley, Saulpaugh and Bameet as applied to 
claim 12 apply to claim 17. 
k. Regarding claim 18, Rowley shows wherein reconstructing the objects comprises: 
sorting the intercepted data into packets; and sorting the assembled flows by protocol 
(column 4, lines 9-12: packets are sequentially read, decoded, checked and added to 
the protocol sorted list until the last packet has been retrieved ; column 6, lines 59-65: 
local cache holding word processing documents, PDF files, audio files and video 
files). 

1. Regarding claim 19, Rowley shows wherein the instructions further cause the 
processor to determine whether each object is to be stored based on a set of one or 
more capture rules (column 3, lines 62-67: packet not needed for the subsequent 
reconstruction of the network communication session). 

m. Regarding claim 20, Saulpaugh shows wherein the instructions further cause the 
processor to receive a query over the stored objects, search the indexed objects in 
response to the query, and retrieve objects matching the query (column 27, lines 10- 
29: query for a message response; column 41, line 60-column 42, lines 10: database 
query based upon name or strings; column 48, lines 33-52: query results cache). 
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Together Rowley, Saulpaugh and Barnett disclosed all limitations of claims 12-20. Claims 
12-20 are rejected under 35 U.S.C. 103(a). 
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Response to Arguments 

8. Applicant's arguments filed on 04/30/2009 have been fully considered, but they are not 
persuasive. 

a. Applicant has argued that there is no reference cited for disclosure on the limitation of 
"the document being captured based on a capture rule that specifies the objects" (see 
last paragraph on page 7 through 1 st paragraph on page 8 of current amendment). 
Examiner has reviewed the claim 1 and 5-6 rejections. Rowley is quoted to be able to 
select packets for subsequent reconstruction of a network communication session 
(column 3, lines 62-67), i.e. some packet filtering is performed and select a portion of 
packets captured by a sniffer during a time internal for reading and decoding (column 
1, line 66-column 2, line 9 and column 3, lines 43-47), i.e. specifying certain packets 
to be processed. With further disclosure from Saulpaugh on reconstructing objects 
from XML data stream (column 82, lines 28-52) and from Rowley on packets 
reconstructed into data and script files for web pages and other contents (column 4, 
lines 29-34), together Rowley and Saulpaugh have disclosed the argued limitation. 
The ability to identify the contents to be captured is well known and disclosed by 
Rowley and Saulpaugh as applied to reconstruct objects from XML data stream per 
Saulpaugh' s teaching and are also disclosed as a filter function specified in Chapter 3 
with specific filer fields definitions for various known protocols in Appendix A of 
Applicant's IDS (received on 08/20/2008) item "Etherreal User's Guide". 
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Conclusion 

9. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy 
as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS 
from the mailing date of this action. In the event a first reply is filed within TWO MONTHS 
of the mailing date of this final action and the advisory action is not mailed until after the end 
of the THREE-MONTH shortened statutory period, then the shortened statutory period will 
expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 
1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

10. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Refer to the enclosed PTO-892 for details. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Peling A. Shaw whose telephone number is (571) 272-7968. The 
examiner can normally be reached on M-F 8:00-4:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William C. Vaughn can be reached on (571) 272-3922. The fax phone number for 
the organization where this application or proceeding is assigned is (571) 273-8300. 

Information regarding the statu9s of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
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applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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Examiner, Art Unit 2444 
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Primary Examiner, Art Unit 2444 



